What a consent platform has to prove, not just collect

A consent management platform, or CMP, is the system that shows a person a notice, records what she agreed to for each purpose, lets her withdraw, and keeps the evidence. Under the DPDP Act that last part carries the weight: Sec. 6(10) says that if a question arises, the Data Fiduciary must prove that notice was given and that consent was given in accordance with the Act and Rules.

A CMP does not make you compliant on its own. It makes one set of duties, the notice, consent and withdrawal duties, something you can run and evidence at scale. This page sets out what those duties are and how to judge a platform against them.

What the Act asks a CMP to do

Four duties map directly to platform features.

Notice. Sec. 5 and Rule 3 require a notice that is understandable on its own, in clear and plain language, with an itemised description of the personal data and the specified purposes, and how to withdraw, exercise rights and complain to the Board. Sec. 6(3) requires the request to be accessible in English or any language in the Eighth Schedule to the Constitution. See consent notice requirements.

Purpose-scoped consent. Sec. 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. A platform that stores one yes/no per user cannot show this. It needs one record per purpose.

Withdrawal parity. Sec. 6(4) requires withdrawal to be as easy as giving consent, and Sec. 6(6) requires the Fiduciary to cease, and cause its processors to cease, processing within a reasonable time. A platform records the withdrawal. Whether it reaches your CRM, data warehouse and vendors is an integration question.

Evidence. Sec. 6(10) is the reason a log is not enough. You need to show which notice version the person saw, when, and what she chose. A tamper-evident record, in which each entry carries the digest of the one before it, makes an after-the-fact edit detectable. The consent receipts page describes that design.

What a CMP cannot do for you

It cannot decide your purposes, and it cannot find the personal data you hold in systems it is not connected to. It does not replace the security safeguards in Sec. 8(5), the breach intimation process in Rule 7 or a rights-request workflow. Sec. 8(1) keeps the Data Fiduciary responsible for compliance irrespective of any agreement to the contrary, which includes the contract you sign with the vendor.

It is also not a Consent Manager. A Consent Manager is a person registered with the Board under Sec. 2(g), Sec. 6(9) and Rule 4, who acts for the Data Principal. Rule 4 comes into force on 13 November 2026 under Rule 1(3); applications open once the Board publishes its process. See what a Consent Manager is and how registration works.

Where cookie consent fits

A website cookie banner is a CMP for one channel. It is worth having, and the useful version blocks trackers until the visitor accepts rather than recording a preference after the tags have fired. The cookie consent product is built on that principle. But the Act is not limited to web traffic. Mobile apps, onboarding forms, call centres and partner leads also collect personal data, and each needs the same notice and purpose handling.

Criteria for choosing a platform

These apply to any vendor, including this one.

1. Per-purpose records. Can you export what one person agreed to, purpose by purpose, with timestamps and the notice version?
2. Notice languages. Does it support the languages your users read, and keep each version?
3. Withdrawal propagation. Does a withdrawal reach connected systems by API or webhook, and is there a record that each acknowledged?
4. Evidence integrity. Can a record be altered or deleted without detection?
5. Integration depth. Web, mobile SDK, server API and bulk import for historical consent.
6. Data location and processor terms. Where is consent data stored, who are its sub-processors, and does the contract carry the flow-down obligations you need under Sec. 8(2)?
7. Exit. Can you take your consent records with you in a usable format if you leave?

A comparison with an established GDPR-first platform is in OneTrust alternative for India. When you are ready to see the lifecycle running, the consent manager product page shows it.

Timing

The notice, consent and withdrawal duties commence on 13 May 2027 under Rule 1(4). Sec. 5(2) covers consent given before commencement: the Fiduciary must give a notice as soon as reasonably practicable and may continue processing until the Data Principal withdraws. Whether to re-permission earlier is a risk choice, not a legal requirement, so decide it alongside the platform rollout. The checklist sequences the work.